1 / 9

Key Derivation

Online Cryptography Course Dan Boneh. Odds and ends. Key Derivation. Deriving many keys from one. Typical scenario . a single source key (SK) is sampled from: Hardware random number generator A key exchange protocol (discussed later)

marisa
Télécharger la présentation

Key Derivation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Online Cryptography Course Dan Boneh Odds and ends Key Derivation

  2. Deriving many keys from one Typical scenario. a single source key (SK) is sampled from: • Hardware random number generator • A key exchange protocol (discussed later) Need many keys to secure session: • unidirectional keys; multiple keys for nonce-based CBC. Goal: generate many keys from this one source key SK k1, k2, k3, … KDF

  3. When source key is uniform F: a PRF with key space K and outputs in {0,1}n Suppose source key SK is uniform in K • Define Key Derivation Function (KDF) as: CTX: a string that uniquely identifies the application KDF( SK, CTX, L):= F(SK, (CTX ll 0))ll F(SK, (CTX ll 1))ll⋯llF(SK, (CTX llL))

  4. KDF( SK, CTX, L):= F(SK, (CTX ll 0))ll F(SK, (CTX ll 1))ll⋯llF(SK, (CTX llL)) What is the purpose of CTX? Even if two apps sample same SK they get indep. keys It’s good practice to label strings with the app. name It serves no purpose

  5. What if source key is not uniform? Recall: PRFs are pseudo random only when key is uniform in K • SK not uniform ⇒ PRF output may not look random Source key often not uniformly random: • Key exchange protocol: key uniform in some subset of K • Hardware RNG: may produce biased output

  6. Extract-then-Expand paradigm Step 1: extract pseudo-random key k from source key SK step 2: expand k by using it as a PRF key as before extractor prob prob k SK salt salt: a fixed non-secret string chosen at random

  7. HKDF: a KDF from HMAC Implements the extract-then-expand paradigm: • extract: use k ⟵ HMAC( salt, SK ) • Then expand using HMAC as a PRF with key k

  8. Password-Based KDF (PBKDF) Deriving keys from passwords: • Do not use HKDF: passwords have insufficient entropy • Derived keys will be vulnerable to dictionary attacks PBKDF defenses:salt and a slow hash function Standard approach: PKCS#5(PBKDF1) H(c)(pwdll salt): iterate hash function c times (more on this later)

  9. End of Segment

More Related